How to develop a security culture, interview with Gert Jan Hofstede
Re-thinking The Human Factor with Bruce HallasShow Notes
How to develop a security culture, interview with Gert Jan Hofstede Understanding the role of culture is crucial if we want to develop a security culture. Especially if we want to have a realistic chance of influencing behaviour, which is probably why we're wanting to develop a security culture in the first place. This is because culture is like a body of water. If you come at the water from high above at too high a velocity with a massive, weighty body of change, the body of water will act like a slab of concrete. You'll get a very different response, however, if you approach the water from a closer range, at a slower speed and with something more streamlined. You'll glide through to the underside of the water and be able to explore the intricate inner-workings of the ecosystem contained within. It's that understanding which will guide your cyber security awareness, behaviour, and culture initiatives towards a greater chance of success.
Gert Jan Hofstede joins us for a second time on the show for Episode 23 of the Re-Thinking the Human Factor Podcast. Gert Jan is a population biologist and social scientist hailing from the Netherlands. His research and publications have provided many with deeper understanding in the areas of cultural evolution, societal change, cultural stability, and how those forces interact with and have influence upon one another. Gert Jan is also known for his work in social simulation as well as for a number of books he has co-written with his father, Geert Hofstede.
"This is where culture is really at its most useful. To know that similar social results… to take a group where it should go, have to be reached by different ways by different routes in different cultures."
JOIN GERT JAN HOFSTEDE AND BRUCE HALLAS AS THEY DISCUSS: Brexit, and drawing a comparison between the importance of understanding the cultural dimensions at play in Britain, and likewise, the cultural forces at play in one's organisation.
The importance of recognising and acknowledging that we don't even recognise our own cultural biases and the errors that lack of understanding of ourselves can cause.
Increased usage of the word 'culture', especially in job titles, as companies strive to develop a security culture.
How the meaning of the word 'culture' can easily differ from organisation to organisation depending on the broader cultural context of the society in which the organisation is situated. This is because the social and technical systems of an organisation are dovetailed in everyday behavioural dynamics
Along with being cognisant of cultural differences, we also needs to learn how to properly interpret those differences. We have to remember that our brains naturally make quick decisions about people and groups, who's in and who's out.
Has culture evolved to help us address our deep seated anxiety about the unknown?
The status quo bias - that people stay rooted in doing what they normally do until it gets to the point where it's a disaster.
You can't change the culture of a society, but you can change the culture of an organisation, but it's very hard and takes time.
Influencing an existing culture vs. creating a new security culture, and whether or not one can or should develop a security culture that's separate.
Values dimensions and using a whistleblower. This is an example of how values can influence societal responses to these kinds of people in differing ways depending on the values of the culture within which the whistleblower is situated.
Using a cultural framework to look at incidence reporting in which people report on themselves for their mistakes.
A helpful tip for those working in multicultural environments for working through the behavioural differences they experience.
"I think there's nothing better than international experience with reflection."
RESOURCES AND LINKS FOR FURTHER RESEARCH: Gert Jan Hofstede's first appearance on the Re-Thinking the Human Factor Podcast
MORE
More from Re-thinking The Human Factor with Bruce Hallas
In this episode we re-visit an earlier theme explored in this series. The theme of mesurement and metrics. The question of how to measure awareness, behaviour or culture is something we consistently come across here at Re-thinking the Human Factor when exploring opportunities to work with clients. There's an palpable feeling, across industry chatter, that there's a real lack of maturity when it comes to how we demonstrate the effectiveness of our effrots to influence employee awareness, behaviour and culture. However, there is hope. In this episode I talk with Bernie Smith. Bernie has a focus on KPI's, not just your standard range but also he brings ideas about how you might create new metrics as well. We discuss his view on the development of metrics and how metrics can help not just measure performance but ultimately influence behaviour and shape culture.
In this episode we take a peek at the role of the security teams' own culture and its impact on the broader organisational culture. This, is an important perspective, because whilst many commentators focus on influencing organisational culture they haven't considered the role that the value and behaviours of the security team has in influencing positive security outcomes across the business. To help us explore this perspective, on cultural forces at play, we have a guest who knows a thing or two about how cultures are formed and influenced. Lianne Potter studied in social anthropology, then geeked out on technology before combining the two to shape an industry career which has achieved numerous accolades for her thought leadership in not just the human factor but also information security generally. Lianne, for me, illustrates a small, but growing force within the industry that recognises that the human factor needs to be repositioned not as an after thought once all the work of designing security controls has been done, but as a critical and key part of the process of understanding and managing information security risk. ©Copyright Marmalade Box Limited The content of this podcast is the property of Marmalade Box Limited. Any use of the content of the podcast, either in full or partially, will be considered an infringement of Marmalade Box Limited rights as sole owners of this content. Any enquiries about the use of this content should be directed to Marmalade Box Limited. Contact information can be found at www.marmaladebox.com .
If you're a regular listener then you will have already met today's guest Dr. Char Sample. Char is a force at work deep within the information security community. Char is a rarity, combining a deep knowledge of both the technical and human aspects of the challenges security professionals face when managing cyber security risks. Char and I go back a long way, to a horrible conference lunch in London, where her riveting conversation meant I didn't have to eat what was on the plate in front of me. I have been forever grateful. That riveting conversation was all about our shared understanding of how culture influences everyone's day to day behaviours and how everyday behaviours make up culture. That shared interest has led to many conversations and shared ideas about how the information security industry could step up a level by seeing the potential for improving how we assess and manage human factor risks. In this episode we capture one of those conversations. We talk about heuristics and biases, what they are and what role they might have in artificial intelligence. Why what makes us human often makes us behave in seemingly irrational ways even when presented with all the data we need and assumptions we frequently make when developing and designing systems and processes and how this is undermining the management of business risks. Be warned, there's a lot of laughter in this episode.
In this episode we are joined by a guest who has committed their career to the world of advertising agency work. Influencing target audiences awareness of products and stacking the odds in their clients favour, that the target audience will choose their product over their competitors. The challanges our guest has faced, over the years, are in many ways similar to those that education and awareness managers, for information security and data protection, now face.